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Amendments to the Specification: 

Please amend the specification as follows: 

Please replace the paragraph numbered as indicated below with the following rewritten 
paragraphs: 

[0048] Figure 21 is an overview block diagram of the elements involved in the 
execution of analyzers including the analyzer harness 806 and its elements such as the analyzer 
loader, the analyzer descriptor, and the analyzer argument manager. 

[0049] Figure 22 presents a flow diagram of the detailed steps carried out by 
elements of the analyzer harness 806 (shown in Figure s 2 and 8, and shown in detail in Figure 
21) when it executes an analyzer. 

[0081] Figure 2 also illustrates the components located at a central site. The 
\ ^ central site includes an analyzer server 800 situated remote from the enterprise 300. The 

analyzer server 800 is linked to the enterprise 300 via an ISDN line or some other form of wide 
area network 323 and by a tracker database 106 within an HAO server 105 . The An HAO server 
105, a report generator server 202, and a legacy server 210 are also part of the central site. The 
HAO server 105 is linked to the support node 308 by the ISDN line or wide area network 323 . 
Files of configuration information generated by the collectors 104 of the enterprise 300 are saved 
in the [[a]] tracker database 106. These files are retrieved from the tracker database 106 by an 
analyzer harness 806 within the analyzer server 800, as is described below. 

[0100] In Figure 3, the nodes 302 and 304 and possibly many other nodes exist 
at the enterprise site 300. These nodes would typically be servers, but they could be routers, 
printers, and other computational devices that are to be monitored. Also at the enterprise site 
300, a support node 308 is networked together to the other nodes 302 and 304. The support 
node 308 includes tools (the HAO system) that enable the collectors 104 to run periodically upon 
the nodes 302 and 304 and other enterprise nodes, thereby generating information defining the 
static and dynamic configuration of the nodes 302 and 304 and other nodes. The support node 
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program 402 (Figure 4) captures the reports generated by the collectors 104 and transfers them 
through the firewall 324 and over some form of wide area network 323 to the tracker database 
106 within an HAO server 105 that is typically located at a central site. 

[0122] Once the analyzers 1 10 are created and installed and the report templates 
and rules 1 16 are put in place, the system may then be called upon to do an assessment of the 
enterprise 300. An auditor 813-&i4, who may be an engineer or some other person desirous of 
learning about the condition of the nodes 302, etc. in the enterprise 300, requests an audit by 
using a task definition system 810 to create an assessment task. At 814, an assessment task A is 
shown. The assessment task 814 includes, in its definition, a list of the enterprises that are to be 
analyzed, a list of the nodes at each enterprise which are to be subjected to analysis, and a list of 
the analysis that is to be performed in the form of the actual names of the analyzers which are to 
be executed. In addition, the assessment task 814 includes a list of the reports that are to be 
generated following the analysis. Report generation may be done at the time of the analysis, or 
the reports may be generated at a later time in a separate session. 

[0126] Figure 10 presents a flow chart of the process by which an auditor 813 
&±4<iefines the assessment task that is to be carried out by the analysis server 800 during any 
given processing operation. 

[0127] The auditor 813 & 14-begins by specifying the type of assessment that is 
to be carried out. At 1002, a first type of assessment is the "full audit request." The full audit 
request looks at all aspects of the enterprise 300, right down to the smallest details. It also 
generates high level reports for management and for others, drawing general conclusions about 
the state of the enterprise, the nature of the problems found, and the possible solutions that may 
be considered. It is the full audit request or full audit of portions of an enterprise that takes full 
advantage of the present invention's ability not only to collect lots of configuration information 
using collectors 104 about an enterprise 300 and to analyze that information using multiple 
analyzers 1 10, but also to have rules associated with a report generator 206 that can look over the 
issues developed by the analyzer 110, scan the issue information looking for statistical 
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indications and trends, and also compare present and past issue information to see trends over 
time, generating meaningful reports about where the enterprise 300 is headed and what can be 
done to prevent its failure and to improve its flow operations and reliability. Once this 
V s ) information is known, communicated, and polished, it is possible to move into the realm of self- 
healing systems. In this realm, an issue is detected automatically, the recommended action is 
known, and the issue is fixed before it becomes a problem. The customer is notified of the fix 
rather than the issue. 

[0130] The auditor 813 S44 may select any one of several different types of 
coverage for each of these assessments. An overall assessment runs all the analyzers 110 and 
generates a large amount of issue information about all aspects of an enterprise 300. A hardware 
and operating system assessment runs only those analyzers 110 that focus upon the hardware and 
operating system elements, as opposed to their programs, file systems, networks, etc. A 
networking assessment focuses upon the networking aspects of an enterprise 300, including such 
things as network load, network slow-down, and the conditions of the various network routers 
and switches. A file management and storage assessment focuses upon the condition of the disk 
drives, the availability of space within the file system, and other such issues. The assessment 
hierarchy available for task definition can match the assessment XML hierarchy of XML control 
information for the individual analyzers, as is illustrated in Figure 25 and as is explained at a 
later point. 

[0131] The next step in the task definition process is step 1004, selecting a 
tentative list of analyzers consistent with the assessment type selected. The tentative list of 
analyzers 1 10 is selected automatically by the task definition system 810 and is displayed with 
check boxes beside each analyzer name; and then the auditor 813 is permitted to view and to 
modify the list of the analyzers that will actually be processed by possibly adding some, and by 
possibly eliminating some that are not required or essential to a given audit. Only the analyzers 
with their check boxes checked are actually executed. 
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[0132] Next, the location of the assessment is designated. At step 1006, a 
region (United States, Europe, etc.) is selected, or possibly a legacy database 212 source of 
information is selected if real-time monitoring of the enterprise 300 to be audited is not presently 
implemented. At step 1008, one or more enterprises 300 within the selected region are selected 
for auditing. At step 1010, a listing of the enterprise 300 nodes 302, etc. is automatically 
generated and displayed, again with check boxes, such that the auditor 813 may go in and remove 
some nodes from the audit, and add other nodes to the audit. Next, at step 1012 in Figure 11, the 
auditors enter information identifying themselves and also comments, such as a general statement 
of why the audit is being conducted. For example, if the customer has been experiencing certain 
difficulties, the auditor 813 may wish to summarize this at this point so that the reason for the 
audit appears in the audit report. 

[0133] At step 1014, the nature of the report or reports desired is selected. The 
auditor 811 may only report a management summary report, or he or she may request a technical 
summary report. On the other hand, the auditor 813 may wish to see all of the technical details. 
A special marketing report, indicating areas where the enterprise may be persuaded to purchase 
additional software or hardware, can also be generated. A detailed manufacturer's report would 
report on the update level and versions of all the software and hardware and might contain 
information concerning failures that might be useful for future maintenance of the enterprise, or 
that might suggest the need for improvements in system component design. 

[0134] A format for the report is also selected. The text report can be generated 
in the form of a word processing document suitable for printing in color. High-level reports 
might be generated in presentation format for projection and display to management. An HTML 
report might link to underlying explanatory details from a general report. Additionally, the 
auditor 813 &±4 may wish to request that statistical information be presented in tabular, graphic, 
or chart form to make it easier to understand. 




[0143] At step 1206, the content expert d e signer 812 is presented with a list of 
all the collectors, organized by managed element class, and is invited to select which collectors 
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will provide input information to this analyzer. In general, a single analyzer may accept input 
information from one or any number of collectors 104 and may then process that information in 
any number of complex ways. Dozens of collector-generated node configuration files may be fed 
into an analyzer that may be a huge computer program written in "c" or "c++" and compiled 
from numerous "c" or "c++" program files under the control of a "make" file. On the other 
hand, an analyzer may be a very simple program written in "Java" or "perl." To keep the example 
being developed here simple, the analyzer will collect information only from the collector 
identified as "disk usage" and assigned the identification number "100024". 

[0150] With reference to Figure 13, step 1212 calls upon the content expert 
d e sign e r 812 of an analyzer 1 10 to specify which nodes 302 it is to analyze, if necessary. The 
K default is that an analyzer 110 processes all nodes 302, and then the analyzer 1 10 is called upon 
V by the analyzer harness 806 to process files generated by the collectors 104 for all of the nodes 
302, 304, 306, (etc.) in sequence, with the analyzer 110 being executed one time for each node 
with different input file argument lists provided each time the analyzer 110 runs. 

[0158] When one is done entering the information concerning an analyzer, an 
/\ XML descriptor creation utility 1404 generates the XML file, such as that illustrated in Appendix 
v C, automatically. A manager 1406 may also be provided that manages analyzer issue lookup 

tables which relate analyzers to specific issues. 

[0201] Accordingly, one achieves the conceptual assessment XML hierarchy 
shown at 2502 in Figure 25 with little change to the current harness. Then, in Figure 26, the task 
definition system 814 is modified such that at step 2602 (which replaces step 1002 in Figure 10) 
one merely specifies a desired assessment type in the outline structure defined by the large XML 
structure 2502 shown in Figure 25. This task assessment type corresponds to a set of managed 
elements which correspond to a subpart of the XML hierarchy shown in Figure 25 and which 
contains all the analyzers 1 10 for the set of managed elements. Note that the XML data 21 18 
(see Appendix C) for the "Disk Usage" analyzer appears beneath "File System", "Logical 
Volumes", and "File System Usage Analyses" in the exemplary XML structure shown 
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symbolically at 2502 in Figure 25. At step 2604 (which replaces step 1502 in Figure 15), one 

simply passes to the analyzer harness 806 the lists of enterprises and nodes, along with the larger 

XML structure 2502 that includes, as a substructure, the list of the analyzers that are to perform 

i \P in accordance with Figure 25, including the portion of the XML structure in Figure 25 which the 

s\ auditor 813. has designated for execution. The analyzer harness 806 then carries out these 
V 

assessments automatically, covering as much or as little of the system hardware and software as 
the auditor 813 desires to have covered in any given analysis operation, controlled entirely and 
continuously by the XML structure of Figure 25 and by that portion of this structure which the 
auditor 813 has designated for execution. 
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